CVE-2026-44329 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on the SBI can hit UPI endpoints with no Authorization header at all, and the requests reach the SMF business handlers. In the running Docker lab this was directly demonstrated for read (GET /upi/v1/upNodesLinks), write (POST /upi/v1/upNodesLinks with attacker-controlled UP-node and link payload), and delete (DELETE /upi/v1/upNodesLinks/{nodeID}) operations. This vulnerability is fixed in 4.2.2.
A vulnerability exists in free5GC's Session Management Function (SMF) prior to version 4.2.2, where the User Plane Interface (UPI) management route group is mounted without proper OAuth2 authorization middleware. This oversight allows network attackers to send requests to UPI endpoints on the Service-Based Interface (SBI) without an Authorization header, directly reaching the SMF business handlers. The vulnerability has been validated in the official Docker lab, where it was demonstrated that unauthenticated requests could successfully perform read, write, and delete operations on UPI management resources. In contrast, requests to the protected 'nsmf-oam' group on the same SMF instance were correctly rejected due to missing authorization.
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/887 | CISA-ADP | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-3258-qmv8-frp3 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/issues/887 | [email protected] | ExploitIssue Tracking |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-3258-qmv8-frp3 | [email protected] | ExploitVendor Advisory |
| https://github.com/free5gc/smf/commit/e23ce97565f285eb99eed153743c62bf4c767c6e | [email protected] | Patch |
| https://github.com/free5gc/smf/pull/197 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |